Tech / IT Support · beginner
Segmented Home Lab Network with VLANs and DNS Filtering
A real segmented network — separate VLANs for trusted devices, IoT, and guests, with firewall rules between them, Pi-hole DNS filtering, and packet captures that prove the isolation works.
Project overview
Interviewers for IT support and networking roles ask about VLANs, DNS, and subnetting constantly — and almost every candidate answers from a textbook. Having built a segmented network and captured the traffic to prove it lets you answer from experience, which is immediately obvious to the person asking.
Real-world use case
A small business needs its point-of-sale terminals isolated from guest Wi-Fi and staff laptops so a compromised phone on the guest network cannot reach payment systems.
Tools and technologies
- pfSense
- VLANs
- Pi-hole
- Wireshark
- VirtualBox
Skills you can demonstrate
Network Segmentation, Firewall Rules, DNS, Packet Analysis, Troubleshooting
Build roadmap
- Plan the subnets on paper first
Decide your VLAN IDs and address ranges before touching a console. Write down which segment should reach which. Ten minutes here saves hours of confused debugging. - Install pfSense
Run it in VirtualBox with two adapters, or on a spare mini PC if you have one. Complete the initial WAN/LAN setup and reach the web UI. - Create the VLANs and interfaces
Define VLANs 10, 20, and 30, assign each an interface, and enable DHCP on each with the ranges from your plan. Confirm a client on each VLAN pulls the right address. - Write the firewall rules
Implement the isolation rules using the AI prompt below. Remember rules evaluate top-down and the default is deny — test after each rule instead of writing them all at once. - Add Pi-hole for DNS filtering
Deploy Pi-hole and point every VLAN at it for DNS. Watch the query log to see exactly what your devices talk to — this is usually the moment the project gets interesting. - Prove it with Wireshark
Capture traffic while attempting to ping from IoT to trusted. Show the blocked attempt. Save the capture — a screenshot of a dropped packet is your evidence the segmentation is real.
Ways to extend the project
Add a site-to-site WireGuard tunnel to a cloud VPS and document the routing, so remote devices land in the correct VLAN as if they were on-site.
How to showcase your work
- GitHub: README with a network diagram, your subnet table, the firewall ruleset, and Wireshark screenshots showing blocked cross-VLAN traffic.
- LinkedIn: Post the network diagram and one packet capture proving an IoT device cannot reach your laptop — visual, concrete, and instantly understandable.
- Resume: Highlight "Network segmentation (VLANs)", "Firewall administration", and "Packet analysis".